Skip to content

[New] Endpoint Rule Conversion PR #5658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
DefSecSentinel merged 34 commits into from
Feb 6, 2026
Merged

[New] Endpoint Rule Conversion PR #5658

DefSecSentinel merged 34 commits into from
Feb 6, 2026

Conversation

@DefSecSentinel
Copy link
Contributor

@DefSecSentinel DefSecSentinel commented Jan 30, 2026 •
edited by Mikaayenson
Loading

Pull Request

Issue link(s):

#4456

Summary

This PR introduces 35 new macOS detection rules migrated from endpoint to enable late-stage kill chain detection through SIEM alerting.

Strategic Rationale
This migration follows the Kill Chain & Confidence Model for macOS detection strategy:

Endpoint Rules (BLOCK): Focus on early kill chain stages (Initial Access, Execution, Defense Evasion) where immediate blocking prevents compromise
SIEM Rules (ALERT): Focus on late kill chain stages (Persistence, Discovery, Collection, C2, Lateral Movement) where alerting enables investigation of potentially compromised systems
Rules selected for SIEM migration represent behaviors that:

Occur after initial compromise and require investigation rather than blocking
Have higher false positive potential in endpoint blocking context
Provide threat hunting value through correlation with other signals
Detect post-exploitation activity where blocking would not prevent the initial compromise

@DefSecSentinel DefSecSentinel self-assigned this Jan 30, 2026
@DefSecSentinel DefSecSentinel added OS: macOS Rule: New Proposal for new rule labels Jan 30, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 30, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: add timestamp_override, investigation guides, and fix MITRE mapping
a6f2ed3 
- Added timestamp_override = 'event.ingested' to 15 non-sequence EQL rules
- Added '## Triage and analysis' investigation guides to 19 high-severity rules
- Fixed T1176 technique name from 'Browser Extensions' to 'Software Extensions'
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
Enhance investigation guides for 19 high-severity macOS SIEM rules
179d6a4 
Enhanced investigation guides to align with existing SIEM rule format:
- Added detailed context paragraphs explaining the threat and detection logic
- Expanded investigation steps to 6-7 items with specific field references
- Enhanced false positive analysis with 4-5 items and exclusion guidance
- Added comprehensive response and remediation steps (6-7 items)

Rules enhanced:
- Defense Evasion: dylib_injection, gatekeeper_override, tcc_access
- Persistence: shell_profile, hidden_plist, chromium_extension, startup_item,
  pkg_install_script, launch_agent_daemon
- Execution: unusual_library_python
- Lateral Movement: jamf_endpoint
- Command and Control: google_calendar_c2, oast_domain, etherhiding,
  curl_from_app, curl_google_script, unsigned_binary
- Collection: pbpaste, sensitive_file_compression
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
Fix investigation guide tests: add Resources tag and fix OAST title
f25175f 
- Added 'Resources: Investigation Guide' tag to all 19 rules with investigation guides
- Fixed OAST rule investigation guide title to match rule name exactly:
  'Network Connection to OAST Domain via Script Interpreter'
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 5, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 5, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous
Samirbous approved these changes Feb 6, 2026
View reviewed changes
DefSecSentinel and others added 2 commits February 6, 2026 10:11
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
4ef8935 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
5b56688 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

DefSecSentinel and others added 2 commits February 6, 2026 10:12
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
990e67d 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@DefSecSentinel @Samirbous
Update rules/macos/defense_evasion_suspicious_tcc_access_granted.toml
253bc13 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_manual_chromium_extension_loading.toml
6943135 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_startup_item_plist_creation.toml
b4c78a1 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_suspicious_launch_agent_or_launch_daem…
1517f19 
…on.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_suspicious_launch_agent_or_launch_daem…
0a497ee 
…on.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @cursoragent
Fix ESQL syntax error in AWS S3 connection rule
4135182 
Remove trailing comma before BY clause in STATS command that caused a parsing_exception.

Co-authored-by: Cursor <cursoragent@cursor.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel DefSecSentinel merged commit 43d3f3b into main Feb 6, 2026
14 checks passed
@DefSecSentinel DefSecSentinel deleted the migrate branch February 6, 2026 16:53
@DefSecSentinel DefSecSentinel mentioned this pull request Feb 7, 2026
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Samirbous Samirbous Samirbous approved these changes

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

Assignees

@DefSecSentinel DefSecSentinel

Labels

backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@DefSecSentinel @tradebot-elastic @Mikaayenson @Samirbous @Aegrah @terrancedejesus